VMware remediates critical zero-day vulnerabilities

Target Industry 

Indiscriminate, opportunistic targeting. 

Overview  

Security updates have been released with regards to VMware flaws that could allow for code execution on systems operating vulnerable versions of the Workstation and Fusion software hypervisors. The vulnerabilities are being tracked as follows: 

CVE-2023-20869: Stack-based buffer-overflow vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine.  

CVE-2023-20870: Out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth devices with the virtual machine. 

VMware also addressed the following flaw as a part of the security update release: 

CVE-2023-20871: VMware Fusion contains a local privilege escalation vulnerability.       

Impact  

– Successful exploitation of CVE-2023-20869 could allow threat actors to execute code as the virtual machine’s VMX process running on the host. 

– Successful exploitation of CVE-2023-20870 could allow threat actors to read privileged information contained in the VM hypervisor memory. 

– Successful exploitation of CVE-2023-20871 could grant threat actors with read/write access to the target host operating system to escalate privileges and gain root access to the host OS. 

Vulnerability Detection 

VMware has released security updates with regards to these vulnerabilities. As such, previous versions are vulnerable to potential exploit. 

Affected Products 

– VMware Workstation Pro / Player (Workstation) 

– VMware Fusion    

Containment, Mitigations & Remediations 

It is strongly recommended that users of the affected products versions apply the relevant security updates that can be found at the [VMware advisory page](https://www.vmware.com/security/advisories/VMSA-2023-0008.html). 

With regards to CVE-2023-20869 and CVE-2023-20870, the following workaround exists: 

– Turn off the Bluetooth support on the virtual machine by unchecking the “Share Bluetooth devices with the virtual machine” tab.  

Indicators of Compromise 

No specific Indicators of Compromise (IoCs) are available at this time. 

Threat Landscape 

VMware has a significant proportion of the virtualisation market share. Given that threat actors generally utilise a combination of probability and asset value to determine which attack surfaces to focus on, VMware products have become a prime target for threat actors. Due to the fact that virtual machines have become an integral aspect of both personal and business affairs, threat actors will continue to exploit vulnerabilities contained within the associated devices in an attempt to extract the sensitive information contained therein. 

Threat Group 

No attribution to specific threat actors or groups has been identified at the time of writing. 

Mitre Methodologies 

Tactic: 

TA0002 – Execution 

Tactic: 

–TA0004 – Privilege Escalation 

 Further Information 

VMware Advisory